Geek's Advice

PPHG ransomware encrypts your computer files, threatens to keep them locked until a ransom is paid

PPHG ransomware is a malicious virus that encrypts all files on victim’s computer, rendering them useless. It is the 429th variant from the STOP/DJVU malware group which uses .pphg extension to mark encrypted files. To illustrate, file originally named 1.jpg becomes 1.jpg.pphg after the cyberattack. To provide the victim with information about what happened, the virus also drops _readme.txt files, also known as ransom notes, throughout the computer. The note holds a message that suggests the victim has to pay a specified price in order to get PPHG file decryption tool. In other words, the cybercriminals demand a ransom.

The _readme.txt notes also suggest that all of victim’s files, including photos, videos, archives, documents and databases have been encrypted with strongest encryption algorithm and unique key generated for the victim. Clearly, this is a huge damage since we all keep important files on our computers – study or work related as well as personal memories. The note goes on to explain that the only method to recover files is by paying up what the crooks demand, and leave two email addresses so that the victim could write a message to them – support@sysmail.ch and supportsys@airmail.cc.

They suggest sending one encrypted file (preferably one without valuable data in it) to the attackers via email to receive a decrypted version of it. The note also includes decryption tool pricing, which varies depending on how fast the computer user decides to contact the criminals and pay up. As explained in the note, the ransom amount will be cut by 50% and set to $490 for those who manages to arrange an agreement with the criminals within 72 hours (3 days) from the infection timestamp. If delayed any longer, the decryption tool will cost $980.

Victims who decide to contact the attackers will receive further instructions on how to pay the ransom. The criminals only accept cryptocurrency as a payment form, ideally, in Bitcoin. Such transactions cannot be traced down by law enforcement agencies and this is exactly what the attackers want.

We must emphasize the importance of saying no to ransom payments. In general, you should follow the advisory of FBI when it comes to ransomware attacks. Here are some arguments why you should refuse to pay up:

• Chances to recover files are slim even if you pay the ransom;
• Paying the ransom helps cybercriminals to continue their operations and motivates them;
• This ransomware tends to install information-stealing Trojans on the system, so the blackmail will continue;
• Paying a ransom might be considered illegal in your area of residence.

Speaking of additional damage caused for the infected system, this ransomware variant is known to drag VIDAR or AZORULT Trojans into the system. Both of these threats are capable of stealing browser-saved login credentials for various websites, in-app login credentials (such as Skype or Telegram), also browsing history, cookies, banking details and even more. Collection of such sensitive data can come in handy for cybercriminals who might be planning to blackmail you further.

All things considered, it is best to remove PPHG ransomware virus and related malware from your computer – the sooner, the better. For this matter, you should follow instructions presented below this article to learn how to boot your PC in Safe Mode with Networking. For best results, we recommend using an up-to-date antivirus software. Our team trusts INTEGO Antivirus which we find excellent in removing malware. For repairing virus damage on Windows OS files, download RESTORO and run a full system scan.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware Distribution Techniques Commonly used by Cybercriminals

STOP/DJVU ransomware variants, including PPHG virus, are known to spread via illegal online downloads. Cybercriminals tend to prey for potential victims who are looking for ways to activate paid software versions for free, or, in other words, search for software cracks and 100% full working versions of popular programs. These typically can be downloaded via Peer-to-Peer (P2P) file sharing networks using a torrenting client. Another way these malicious downloads are promoted is via rogue websites offering password-secured archives containing a setup which is nothing else than a malware installer. Running such file compromises the system in seconds instead of installing the user-desired software.

Victims of previous STOP/DJVU versions report downloading pirated versions of these popular programs only to end up with all of their computer files encrypted:

• KMSPico (illegal Windows activation tool).
• Fifa 20;
• Microsoft Visio Pro;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• VMware Workstation;
• Internet Download Manager;
• Adobe Photoshop.

It is a well-known fact that pirated software versions are packed with malware. Even if you do not notice anything suspicious at first, the malware included might be programmed to start after a specific time period. No matter what, we strongly recommend you to support legitimate software developers and obtain legitimate license keys. Otherwise, the damage caused by illegal downloads might result in much higher expenses and loss of data as well as personal information theft. If you’re in need for a specific computer application, make sure to visit its official developer’s website or look for deals on confirmed partners’ sites.

Another common way to spread ransomware-type viruses is by attaching malformed files to spam emails. Cybercriminals craft up documents containing malicious scripts, name them as Invoice, Order Details, Tracking Information, etc. and insert them as email attachments along with a convincing message urging to view attached files. On top of that, crooks often pretend to be someone from a well-known company (such as eBay, Amazon, DHL, or even your workplace). To appear trustworthy, they may even leverage email address spoofing techniques that help to obfuscate the original sender’s address and display one that seems to be an official address of a well-known company. Our advice is to avoid opening email attachments if you have even a slightest suspicion or feeling that the email comes by surprise (for example, if you didn’t order anything online or if you weren’t supposed to receive an invoice from the said company).

Victims of STOP/DJVU ransomware should also be careful around suspicious websites offering miracle decryption tools as these can hide additional malware in them. You must understand that encryption is a complicated procedure and reversing it is extremely complex and time-consuming procedure. Therefore, rely on trustworthy resources only. At the moment, files encrypted by STOP/DJVU can only be decrypted in case you’re affected by an old version or offline encryption type (more on this later). You can also repair certain data formats with minimal data loss as explained in this guide. Watch out for scammers offering their services via Instagram or Whatsapp as these can steal your money and disappear into thin air.

More on the modus operandi of this ransomware

If you’re keen to find out how PPHG ransomware operates and what is the order of its activities on your computer, this section is for you. The malware itself arrives as a bunch of processes, but the most relevant of them are these:

• 1B6G.exe. The ransomware uses randomized 4-character names for its main executable. This file is responsible for data encryption.
• build.exe and build2.exe. These are considered helper processes.
• winupdate.exe. Certain variants of STOP/DJVU tend to run this process in order to display a fake Windows update prompt for the victim.

An interesting detail about this ransomware is that it doesn’t attack computers situated in specific countries. To find out whether the data on the computer can be encrypted, it first requests a response from https[:]//api.2ip.ua/geo.json, which results in geo.json file dropped on a computer. This file contains victim’s computer’s IP address, country, city, zip code, longitude, latitude and other details. You can see a screenshot of the said file examples below.

The virus then compares if the victim’s country matches one from its exception list: Ukraine, Russian Federation, Syria, Armenia, Kyrgyzstan, Tajikistan, Kazachstan, Belarus, and Uzbekistan. If a match is detected, the ransomware stops itself and doesn’t proceed to data encryption phase. Otherwise, it proceeds.

Another file created by the virus is called information.txt. It contains details concerning computer’s hardware, active processes and installed software list. You can see a screenshot of this file below.

At this point, the ransomware requests a unique encryption key from its Command&Control server. If it succeeds to retrieve it, victim’s files will be encrypted with so-called “online encryption” or, in other words, the encryption key used will be unique for the victim. This decreases the chances to recover files to a minimum.

If the connection with C&C server fails, the virus switches to so-called “offline encryption” mode and uses a hardcoded offline encryption key instead. This key is identical for all victims subject to offline encryption by the same virus variant. This encryption type has slightly greater chances to be cracked, since if someone pays the ransom and shares the decryption key with malware researchers, all offline encryption victims can decrypt .pphg files. However, retrieving the key in such manner takes a long time, so victims should be very patient and check for updates here.

To save the encryption key and victim’s ID, the ransomware creates two files: bowsakkdestx.txt and PersonalID.txt. The latter is used to store the ID only, while the first one contains both the key and ID. You can see screenshot of these files below.

The virus then begins encrypting all of computer-stored files with Salsa20 + RSA-2048. To make affected data distinguishable, the ransomware also appends additional extension to their filenames.

To inform the victim about the cyberattack, the virus drops _readme.txt note in each folder. Contents of this file are shown below.

Finally, the ransomware modifies Windows HOSTS file by uploading a set of domains to restrict victim’s access to. It is believed that ransomware operators do not want the victim to reach helpful information online. As a consequence, in attempt to visit any of the blocked URLs, the victim runs into DNS_PROBE_FINISHED_NXDOMAIN error in web browser.

Remove PPHG Ransomware Virus and Decrypt Your Files

The most important task to do after getting infected with such notorious malware is to remove PPHG ransomware virus and associated threats from the system. For this, we suggest booting the PC in Safe Mode with Networking (as explained below) and running your antivirus or anti-malware software. Our team recommends using INTEGO Antivirus as we find it highly effective. On top of that, you may want to go ahead and download RESTORO which is excellent for repairing virus damage on Windows OS files.

There are some additional actions victims are advised to take after PPHG ransomware virus removal:

• Report the ransomware attack incident to a local law enforcement agency.
• Use data backups to recover as many files as possible.
• Learn possible ways STOP/DJVU-encrypted files could be repaired or decrypted.
• Change all passwords used on the infected computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.